CVEvulnerability

CVE-2026-58426

9.6 CRITICAL Published 2026-07-03 Modified 2026-10-25 Official page ↗

Status: Deferred
Published: 2026-07-03
Last modified: 2026-10-25
Assigner: 88ee5874-cf24-4952-aea0-31affedb7ff2
CVSS 3.1 (88ee5874-cf24-4952-aea0-31affedb7ff2): 9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses: CWE-347

Description

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Related

Weakness · CWE (1)

CWE-347 Improper Verification of Cryptographic Signature weakness

References

https://blog.gitea.com/release-of-1.26.2/ blog.gitea.com
https://github.com/go-gitea/gitea/pull/37707 github.com
https://github.com/go-gitea/gitea/releases/tag/v1.26.2 github.com
https://github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6 github.com
https://github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6 github.com